Commit ce78e557 authored by Soenke Huster's avatar Soenke Huster Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: Fix null pointer deref on unexpected status event 



__hci_cmd_sync returns NULL if the controller responds with a status
event. This is unexpected for the commands sent here, but on
occurrence leads to null pointer dereferences and thus must be
handled.

Signed-off-by: default avatarSoenke Huster <soenke.huster@eknoes.de>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 0eee4995

net/bluetooth/aosp.c

+12 −3
Original line number Diff line number Diff line
@@ -54,7 +54,10 @@ void aosp_do_open(struct hci_dev *hdev) 
	/* LE Get Vendor Capabilities Command */

	skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL,

			     HCI_CMD_TIMEOUT);

	if (IS_ERR(skb)) {

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			skb = ERR_PTR(-EIO);



		bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)",

			   PTR_ERR(skb));

		return;
@@ -152,7 +155,10 @@ static int enable_quality_report(struct hci_dev *hdev) 


	skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,

			     HCI_CMD_TIMEOUT);

	if (IS_ERR(skb)) {

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			skb = ERR_PTR(-EIO);



		bt_dev_err(hdev, "Enabling Android BQR failed (%ld)",

			   PTR_ERR(skb));

		return PTR_ERR(skb);
@@ -171,7 +177,10 @@ static int disable_quality_report(struct hci_dev *hdev) 


	skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,

			     HCI_CMD_TIMEOUT);

	if (IS_ERR(skb)) {

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			skb = ERR_PTR(-EIO);



		bt_dev_err(hdev, "Disabling Android BQR failed (%ld)",

			   PTR_ERR(skb));

		return PTR_ERR(skb);

net/bluetooth/msft.c

+12 −3
Original line number Diff line number Diff line
@@ -120,7 +120,10 @@ static bool read_supported_features(struct hci_dev *hdev, 


	skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,

			     HCI_CMD_TIMEOUT);

	if (IS_ERR(skb)) {

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			skb = ERR_PTR(-EIO);



		bt_dev_err(hdev, "Failed to read MSFT supported features (%ld)",

			   PTR_ERR(skb));

		return false;
@@ -319,8 +322,11 @@ static int msft_remove_monitor_sync(struct hci_dev *hdev, 


	skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,

			     HCI_CMD_TIMEOUT);

	if (IS_ERR(skb))

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			return -EIO;

		return PTR_ERR(skb);

	}



	return msft_le_cancel_monitor_advertisement_cb(hdev, hdev->msft_opcode,

						       monitor, skb);
@@ -432,8 +438,11 @@ static int msft_add_monitor_sync(struct hci_dev *hdev, 
			     HCI_CMD_TIMEOUT);

	kfree(cp);



	if (IS_ERR(skb))

	if (IS_ERR_OR_NULL(skb)) {

		if (!skb)

			return -EIO;

		return PTR_ERR(skb);

	}



	return msft_le_monitor_advertisement_cb(hdev, hdev->msft_opcode,

						monitor, skb);